Commit Graph
646 Commits
Author SHA1 Message Date
dependabot[bot] 2c56c4a5b1 Bump github.com/onsi/ginkgo/v2 from 2.14.0 to 2.15.0 in /tests (#191)
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.14.0 to 2.15.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.14.0...v2.15.0)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-18 03:15:51 -08:00
kfox1111andFaisal Memon f8327657cd Add a test and example for federation support (#169)
* SPIFFE OIDC Discovery Provider Rework

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151

Signed-off-by: Kevin Fox <[email protected]>

* Enhance clusterspiffeid's so the discovery provider is independently configurable

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* More fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Undo

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Try to get output

Signed-off-by: Kevin Fox <[email protected]>

* Try and get error code

Signed-off-by: Kevin Fox <[email protected]>

* Fix more logging. Switch port used.

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix port

Signed-off-by: Kevin Fox <[email protected]>

* Fix up logs for nested test and fix values

Signed-off-by: Kevin Fox <[email protected]>

* Make consistent

Signed-off-by: Kevin Fox <[email protected]>

* Fix nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix insecure mode and test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix test.

Signed-off-by: Kevin Fox <[email protected]>

* Fix var scoping issue

Signed-off-by: Kevin Fox <[email protected]>

* Set the right flags for ingress

Signed-off-by: Kevin Fox <[email protected]>

* Update dns template

Signed-off-by: Kevin Fox <[email protected]>

* Use more standard port

Signed-off-by: Kevin Fox <[email protected]>

* Fix test logging

Signed-off-by: Kevin Fox <[email protected]>

* Allow reencrypt.

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing changes

Signed-off-by: Kevin Fox <[email protected]>

* Fix formatting

Signed-off-by: Kevin Fox <[email protected]>

* Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support.

Signed-off-by: Kevin Fox <[email protected]>

* Use spiffe-helper as a sidecar. Significant space savings and read only cert dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix the nested test

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Remove 1.29.0 until deps catch up.

Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>

* Add more error checking

Signed-off-by: Kevin Fox <[email protected]>

* Remove testing code

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the ids. Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix logic

Signed-off-by: Kevin Fox <[email protected]>

* Fix var

Signed-off-by: Kevin Fox <[email protected]>

* Make cert-manager bits more readable

Signed-off-by: Kevin Fox <[email protected]>

* Fix template

Signed-off-by: Kevin Fox <[email protected]>

* Fix openshift ingress

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Add resource spec

Signed-off-by: Kevin Fox <[email protected]>

* Remove parts that cant merge yet

Signed-off-by: Kevin Fox <[email protected]>

* Fix tests

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Add missing configurable for the discovery providers csi driver

Signed-off-by: Kevin Fox <[email protected]>

* Add a test and example for federation support

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Fix ingress annotations for federation bundle endpoint

Signed-off-by: Kevin Fox <[email protected]>

* Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations

Signed-off-by: Kevin Fox <[email protected]>

* Add external secret too

Signed-off-by: Kevin Fox <[email protected]>

* Add forgotten files

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-01-17 15:09:32 -08:00
kfox1111 3ccdb5e4c1 Add tls section to federation bundle endpoint and fix up annotations (#173)
* Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations

Signed-off-by: Kevin Fox <[email protected]>

* Add external secret too

Signed-off-by: Kevin Fox <[email protected]>

* Add forgotten files

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2024-01-17 00:17:15 -08:00
kfox1111 c7ab1319cc Add join_token server nodeattestor support (#187)
Signed-off-by: Kevin Fox <[email protected]>
2024-01-16 14:52:39 -08:00
github-actions[bot]andmarcofranssen 81e9523e03 Bump test chart dependencies (#186)
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
2024-01-15 06:11:02 -08:00
Mariusz Sabath 6d19a76f01 Fix agent daemonset format (#184)
Signed-off-by: Mariusz Sabath <[email protected]>
2024-01-12 21:20:10 +00:00
dependabot[bot] f3a85bdb98 Bump github.com/onsi/ginkgo/v2 from 2.13.2 to 2.14.0 in /tests (#183)
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.13.2 to 2.14.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.13.2...v2.14.0)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-12 00:55:06 -08:00
kfox1111 b61d4f5ae1 Add spire-agent to spire-agent pod path (#180) 2024-01-11 10:39:12 +00:00
kfox1111 befa074763 Fix notes bug (#178) 2024-01-11 10:31:02 +00:00
kfox1111 912c61e05c Remove deprecated version values (#179) 2024-01-11 10:29:56 +00:00
Jerome Meyer ae4ef6e992 Update HorizontalPodAutoscaler API to autoscaling/v2 (#153) 2024-01-11 11:19:41 +01:00
marcofranssen e7a61a9ec5 Bump test chart dependencies
Signed-off-by: GitHub <[email protected]>
2024-01-08 14:39:46 +01:00
kfox1111andFaisal Memon 183e9aa534 SPIFFE OIDC Discovery Provider Rework (#152)
Co-authored-by: Faisal Memon <[email protected]>
2024-01-03 11:40:14 +01:00
github-actions[bot]andmarcofranssen 8f1aba8ad3 Bump test chart dependencies (#171)
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
2024-01-01 06:05:30 -08:00
kfox1111 2454b8cd2a Fix links still pointing at older git repo (#167)
Signed-off-by: Kevin Fox <[email protected]>
2023-12-27 17:10:49 -08:00
github-actions[bot]andmarcofranssen e5c5527fd7 Bump test chart dependencies (#165)
Signed-off-by: GitHub <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
2023-12-25 14:32:18 -08:00
Drew Wellsandkfox1111 e6300087b7 Update jwt test to work with newer slim images (#139)
* install newer version of slim debug

  - switch to step tool for jwt verification against jwk public keys

Signed-off-by: Drew Wells <[email protected]>

* use step-cli image

Signed-off-by: Drew Wells <[email protected]>

* Fix image tag and add upgrade logic

Signed-off-by: Kevin Fox <[email protected]>

* use registry for consistency

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflicts

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Drew Wells <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
2023-12-20 19:14:54 -08:00
kfox1111andMarco Franssen c39dd44526 Add recommendation for namespacePSS (#131)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-21 00:15:56 +00:00
dependabot[bot]andkfox1111 0555c87eef Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /tests (#162)
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.
- [Commits](https://github.com/golang/crypto/compare/v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kfox1111 <[email protected]>
2023-12-20 09:50:41 -08:00
kfox1111 80f9d3823c Revert to older ingress-nginx to fix tests (#161)
Signed-off-by: Kevin Fox <[email protected]>
2023-12-20 09:05:23 -08:00
kfox1111 cb7e7e82c0 Remove 1.29.0 until deps catch up. (#159)
Related issue: https://github.com/rancher/kubectl/pull/94

Signed-off-by: Kevin Fox <[email protected]>
2023-12-19 19:00:41 -08:00
kfox1111 ad905d9c3e Fix the nested test (#158)
Signed-off-by: Kevin Fox <[email protected]>
2023-12-19 16:12:46 -08:00
kfox1111andMarco Franssen 49beb64584 Add recommendation for namespaceLayout (#127)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 15:02:57 +00:00
Marco Franssen 2496c71164 Bump k8s versions for ci workflow (#156) 2023-12-19 15:52:45 +01:00
kfox1111andMarco Franssen f642feafef Fix test logging (#154)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 11:52:21 +00:00
kfox1111 33cacd2ee8 Add recommendation for prometheus exporter (#144) 2023-12-19 11:38:20 +00:00
kfox1111andMarco Franssen 6997d6a904 Add recommendation for securityContext and podSecurityContext (#125)
Co-authored-by: Marco Franssen <[email protected]>
2023-12-19 11:26:26 +00:00
kfox1111 50c4ac35b0 Add recommendation for strictMode (#143) 2023-12-19 12:12:53 +01:00
4fb9d18f50 Bump test chart dependencies (#155)
* Bump test chart dependencies

Signed-off-by: GitHub <[email protected]>

* Revert broken image for now

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: GitHub <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
2023-12-18 09:12:59 -08:00
Mariusz Sabath 811123a207 Update the Tornjak image version (#150) 2023-12-14 23:15:04 +01:00
dependabot[bot] 1f74f6bc13 Bump helm.sh/helm/v3 from 3.13.2 to 3.13.3 in /tests (#149)
Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.13.2 to 3.13.3.
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](https://github.com/helm/helm/compare/v3.13.2...v3.13.3)

---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-13 19:47:49 -08:00
Marco Franssen 94498c0a31 Bump cosign to v2.2.2
Signed-off-by: Marco Franssen <[email protected]>
2023-12-13 08:56:31 +01:00
dependabot[bot] b7e98c4c95 Bump sigstore/cosign-installer from 3.2.0 to 3.3.0
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
2023-12-13 08:56:31 +01:00
kfox1111andFaisal Memon a097606d77 Remove extra example values that are already set by default (#128)
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-12 16:23:23 +00:00
kfox1111 1524537318 Update default for additionalDomains not to include localhost (#146)
Its pretty much only useful if you want to port forward the
discovery provider and use localhost to access it. An uncommon
use case. Its easy to add back for that case. This simplifies
production deploymnet.

Signed-off-by: Kevin Fox <[email protected]>
2023-12-12 08:14:16 -08:00
Marco Franssen 6e997d4f47 Bump cosign to v2.2.2
Signed-off-by: Marco Franssen <[email protected]>
2023-12-12 12:53:15 +01:00
dependabot[bot] 9d483e276e Bump sigstore/cosign-installer from 3.2.0 to 3.3.0
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
2023-12-12 12:53:15 +01:00
kfox1111 8615cb0840 Add devcontainer support to the repo (#98) 2023-12-12 12:50:32 +01:00
kfox1111andFaisal Memon e35838c309 Add recommendation for priorityClass (#124)
* Add a flag to enable recommendations

Signed-off-by: Kevin Fox <[email protected]>

* Add recommendation for priorityClass

Signed-off-by: Kevin Fox <[email protected]>

* Fix vars

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs. Fix typo.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-11 11:42:40 -08:00
kfox1111 9f72a8f971 Use good and automatic defaults for tornjak frontend workingDir (#129)
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
2023-12-11 07:52:44 -08:00
kfox1111andMariusz Sabath 7726351955 Tornjak UBI support (#123)
* Tornjak UBI support

The Tornjak containers now have two different flavors. Vanilla and UBI.
Automatically select the UBI image when deploying on OpenShift.

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
2023-12-11 06:56:58 -08:00
kfox1111 89c07e2d04 Revert openssl 3.2 change (#142)
Signed-off-by: Kevin Fox <[email protected]>
2023-12-11 06:33:24 -08:00
marcofranssen a3d3702049 Bump test chart dependencies
Signed-off-by: GitHub <[email protected]>
2023-12-11 10:44:48 +01:00
80c7653a21 Bump test chart dependencies (#134)
* Bump test chart dependencies

Signed-off-by: GitHub <[email protected]>

* Update charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml

Signed-off-by: kfox1111 <[email protected]>

* Fix Docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: GitHub <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: marcofranssen <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
2023-12-07 22:47:38 +00:00
kfox1111 13f6028ccd SELinux support (#122)
* SELinux support

Add support to the chart to set the SELinux context to enable a working
system. Enable it by default on OpenShift clusters.

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
2023-12-07 11:02:06 -08:00
dependabot[bot] c017d82594 Bump actions/setup-python from 4 to 5 (#137)
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4 to 5.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-07 12:40:31 +00:00
dependabot[bot] 6fda639237 Bump actions/setup-go from 4.1.0 to 5.0.0 (#136)
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4.1.0 to 5.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v4.1.0...v5.0.0)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-07 04:32:42 -08:00
kfox1111andFaisal Memon 3e8335c0ee Add a flag to enable recommendations (#121)
* Add a flag to enable recommendations

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issue

Signed-off-by: Kevin Fox <[email protected]>

* Update after reaching consensus.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-02 05:15:32 -08:00
kfox1111andFaisal Memon 692d463718 Remove unneeded lookup function from upgrade hook (#104)
Those upgrading to 0.17.0 should no longer need the code to check for the old webhook.

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2023-12-01 10:49:29 -08:00
8422b8d141 Added ability to create namespaces (#103)
* Added ability to create namespaces

Signed-off-by: Andrew Block <[email protected]>

* Add openshift labels

Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Andrew Block <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Mariusz Sabath <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
2023-12-01 15:42:27 +00:00